D-Link DIR-655 Firmware 1.21 Hijacks Your Internet Connection 428
chronopunk writes "Normally when you think of firmware updates for a router you would expect security updates and bug fixes. Would you ever expect the company that makes the product to try and sell you a subscription for security software using its firmware as a salesperson? I recently ran into this myself when trying to troubleshoot my router. I noticed when trying to go to Google that my router was hijacking DNS and sent me to a website trying to sell me a software subscription. After upgrading your D-link DIR-655 router to the latest firmware you'll see that D-link does this, and calls the hijacking a 'feature.'"
Why... (Score:3, Insightful)
Is this even legal? This is my device; if it does something I don't like, and can't disable it, that seems like an attack on my rights; to do it to sell ads... that's just low, D-Link!
Re:Why... (Score:5, Insightful)
Thank you! (Score:4, Insightful)
Thank you so much for the warning! I'll stay on 1.20 then and my next router certainly won't be a D-link.
Ran across this just the other day... (Score:4, Insightful)
I helped my father-in-law purchase a wireless router for his home and set it up for him recently. I was rather surprised when I updated the firmware and was then greeted by spam upon opening a web browser. I have to say that I'm really disappointed by d-link on this one. Here's to hoping that the backlash is enough to make them reconsider doing this type of stuff again.
Generally speaking, I'm a fan of their networking equipment (own a dgl-4300 that I'm very happy with myself), but if this is the direction that they are going in, I won't be buying or recommending their stuff anymore. I plan on e-mailing them and telling them I am unhappy with their practices.
Re:Why... (Score:3, Insightful)
Who cares particularly if it is legal or not. What you SHOULD be worrying about is how easy would it be for such a company to take a handsome bribe to allow others to hijack your connection via their firmware/router?
Vyatta anyone? http://www.vyatta.com/ [vyatta.com]
I think it's about time for some serious F/OSS hardware and firmware to replace what was once thought safe and sound from hacking and such.
Re:Slashdot Editors, Do Some Editing (Score:5, Insightful)
there's a separate link at their firmware download page for the DIR-655 that says (in plain view, in a sensible spot): Click here for Firmware 1.21 WITHOUT SecureSpot 2.0
Well, I highly doubt that most customers know what "SecureSpot" is. So how are they supposed to know to download the non-annoying firmware update? Of course, you may say that this is the customer's problem: they should read up on all the features that are being installed in the firmware update, and be sure that this is really what they want, etc.
And, yes, in principle everyone should read every line of each and every EULA.
The fact is that any reasonable person would expect a firmware update to only fix bugs and security flaws. It would not be normal to expect entirely new features to be installed, and it is certainly abnormal for the new "feature" to actually include nagware that prompts you to pay for some new service.
The point here is that what they are doing is sleazy. The default configuration should have that redirect turned off. The link for a "without SecureSpot" firmware is nice, but the fact is that 99.9% of users will only notice that after they have already installed, and been annoyed by, the default update.
It's an annoying thing to do with a firmware update. And in that sense, it's a reason to not do business with them.
Re:Slashdot Editors, Do Some Editing (Score:2, Insightful)
Conclusion? Non-story.
What if I want SecureSpot for its useful features? What if I didn't know SecureSpot redirects me like that?
Re:Slashdot Editors, Do Some Editing (Score:3, Insightful)
If it was that easy to resolve why even bother taking the time to post about it? It seems like it took longer to complain than it did to fix it.
D-Link (Score:4, Insightful)
I've owned several D-Link routers, either through no fault of my own or pressed for time and had to buy it. In all of the years I've had to deal with them, I've learned this:
D-Link is Shit. Buy Linksys.
Re:Why... (Score:2, Insightful)
If it's not illegal then it should be. Accepted on this level can lead it to being applied on others. Your auto-mapping service starts to lead you to a different McDonald's each time you ask it for directions to the hospital. Your Lo-Jack shuts your car down in front of every Denny's you pass. Your mother's health monitoring devices keep connecting to a security marketing sight instead of her heath monitoring provider. Do we even want to discuss what might happen when Roto-Rooter shows up at your place and your lovely wife or daughter answers the door? This service is a FEATURE!
Such garbage is just like telemarketing, its abuse any way you look at it. Just imagine what would happen if every component in your computer included such nonsense and maybe some included by government mandate. Nip it in the bud, else like cancer and government, it just grows uncontrollably.
So much for D-Link (Score:5, Insightful)
Even if there's an option to disable this, the fact that it seems to be enabled by default is enough for me. D-Link from this point on will never be on my list of vendors when looking for networking gear.
Idiots... (Score:5, Insightful)
Apparently they didn't learn from the shitstorm that hit belkin when they did the exact same thing years ago.
Another vendor goes down the tubes...
Re:Slashdot Editors, Do Some Editing (Score:2, Insightful)
Re:Why... (Score:5, Insightful)
Wow. Recent Netgear switches I've bought were doing the whole 70% packet loss thing (of the five white Netgear hubs I've dealt with, three have been completely worthless; haven't tried the blue metal ones lately), and now DLink moves right along with them onto my do-not-buy list. Linksys (won't work reliably with upstream switches) and Belkin (Wi-Fi routers crash constantly when passing wireless traffic) are both so buggy (to the point of being unusable) that they've been on my do-not-buy list for years. I've just about run out of networking hardware manufacturers....
Why can't just ONE SINGLE networking product company make a pledge to stop cutting corners on quality and looking for ways to make a quick buck off their users and just deliver decent hardware!?!?!?!?!?! Don't ANY of these companies' management chains have the SLIGHTEST bit of fiscal common sense?
Sheesh!
Re:More reasons never to go consumer again (Score:3, Insightful)
Re:Slashdot Editors, Do Some Editing (Score:1, Insightful)
And, yes, in principle everyone should read every line of each and every EULA.
In principle, there should be no such thing as EULAs.
That's the end of D-Link. (Score:5, Insightful)
Why are marketing people allowed to destroy companies? Then they go to a new company and do it again.
Re:Why... (Score:4, Insightful)
Ugh. Why? (Score:3, Insightful)
So let's see, Linksys makes generic crap. I'm not completely impressed with my NETGEAR device so I don't think they're that great either. Don't even get me started on how bad Belkin's stuff was. D-Link sounded good, but now this?
NOW what do we go with?
I do agree it's not a HUGE issue since it's able to be disabled, but it's still not good that it's an opt in thing. I'd be buying a piece of hardware to connect to the Internet. NOT a subscription service. It may be good for those not comfortable with computers, but still, not so comfortable with those that DO understand them.
Re:Slashdot Editors, Do Some Editing (Score:5, Insightful)
Plus, upgrading your firmware "just because". Why?
Because router firmware upgrades often mean closing security holes.
While one might think this at first, there's no evidence that this is the case for this incident. It's just as likely, without a firmware being released with specific notes about "holes" that it "plugged", that the update created more bugs.
In this case, it was "I felt like upgrading the firmware". The downfalls: User obviously didn't know how the feature set changed (because didn't do research before upgrading the firmware, just saw that one number was larger than the other) and there's always the possibility of bricking your router that is already working just peachy.
So, no, I don't accept your reasoning, even though it seems "sensible" at the start.
Re:Why... (Score:5, Insightful)
Hell NO. They're absolute garbage! I've seen more fried D-Link routers than every other brand combined. I'd sooner buy any other no-name brand for *more* money. Plus, they've been doing "evil" stuff like that for ages -- not long ago they were hammering a tier-1 NTP server with their firmware (and the poor guy was footing the bill for them on his own). Their garbage is best avoided.
You want a good router? Get a Linksys WRT54GL (that is NOT the G or GS). Then put tomato on it or DD-WRT (they're Linux distros). Then setup opendns and all that in it too. Best router you can get under $500 perhaps (short of a specialized/fancy cisco router that runs IOS and is easy to mis-configure, an expensive specialized routerboard, or power-hungry computer with moving parts...)
Absolutely, positively INFAMOUS (Score:5, Insightful)
Re:Slashdot Editors, Do Some Editing (Score:5, Insightful)
From the goddamn article:
So, you can turn it off. Not only that, but as of 9/30 there's a separate link at their firmware download page for the DIR-655 [dlink.com] that says (in plain view, in a sensible spot): Click here for Firmware 1.21 WITHOUT SecureSpot 2.0
Plus, upgrading your firmware "just because". Why?
Double flame to you buddy.
1) I wouldn't call "WITHOUT SecureSpot 2.0" in plain view. It's not like SecureSpot means anything to me. It has the name Secure so it sounds like something I would want. Now if they named it KickInTheBalls 2.0 or maybe SlapInTheFace 3.2 I would know to avoid it. SecureSpot means nothing to me.
2) Upgrading firmware on a firewall/router why? Are you kidding me? You're going to be-little people who pro-actively secure their main entry point to the outside world. From now on you should lose your Slashdot posting privs.
Re:Why... (Score:3, Insightful)
I dunno. Why do most consumers run back to a company that cheated them like a battered woman to her abuser?
Re:D-Link (Score:5, Insightful)
Consumer-grade shit is consumer-grade shit in every industry. But I think we can have some expectation that when we buy a router, even a cheap shitty one, that it makes a best effort to send the data we ask and not its own marketing message. To use a bad car analogy, I don't expect my car to corner like a race car, to tow a 16-wheel trailer, to be as comfortable as a Benz. But I do expect that it steers where I turn the wheel, and not to the nearest mall.
Lots of consumer-grade shit is ad-supported; we get cheaper shit in exchange for being coerced into buying more cheap shit. Maybe if a company is going to introduce an ad-supported business model to a class of products where it's generally unexpected they should be required to label it prominently.
Re:Slashdot Editors, Do Some Editing (Score:4, Insightful)
So your message is "it's just a small pile of shit, swallow it already?"
No, sir!
It's still abuse if it's a small abuse. There's no such thing as "a little pregnant" or "a little dead". Abuse is abuse is abuse.
Why is this abuse? Because you will be very hard pressed to find a single customer who bought the product, expecting such a feature or, had you asked him, approving it.
If I give you a contract to paint my living room, that does not include the permission to record a porn movie while you're at it. And if I buy a router to handle my traffic, I don't give it permission to reroute me to advertisement.
Re:Slashdot Editors, Do Some Editing (Score:5, Insightful)
The non securespot version has been there since the firmware was released.
"without SecureSpot" certainly doesn't sound like "without spam". It much more sounds like that version is lacking a security feature, don't you think?
Either way, it asks you if you want to try it twice, and then leaves you alone.
So? It shouldn't even "ask" once. Remember that "ask" in this case means intercepting and manipulating traffic. I'm not familiar with applicable US law, but in the UK and Germany, where I know the law a little, this "feature" runs afoul of criminal laws.
Besides, what kind of attitude is that? It's ok to feel up your wife if I stop after being told twice not to?
Re:Why... (Score:5, Insightful)
If you RTFA, you'll see that you CAN disable it.
What are we becoming? Now every sleazy behaviour is ok as long as you can opt-out? That hasn't worked for spam for the past 20 years, has everyone suddenly got a learning disorder?
The default behaviour of absolutely everything that's not a requested feature has to be opt-in.
Opt-out is not good enough. I thought we'd learnt that by now.
Poster should not have posted (Score:5, Insightful)
If I buy a router, I wanted the router. I would not buy a router if I wanted a security stack; I would buy security software.
Re:Slashdot Editors, Do Some Editing (Score:2, Insightful)
Re:Why... (Score:3, Insightful)
You have to manually upgrade the firmware and going back to plan old 1.20 is exactly the same process.
Which raises the question, if you didn't know it was going to do this (because lets face it, who would honestly expect this to have happened before now?), and instead of hijacking google.com, it hijacks the D-Link page where you could download the previous version that you just overwritten, with a link to "pay us money and you can download a fixed version 1.21", what then?
Re:Why... (Score:4, Insightful)
Well, most of these companies take a reference design from the networking chipset manufacturer (Atheros, Marvell, Ralink, etc.), put new plastic around it, and rebrand the drivers. High volume, low margins: not much effort put into support.
Re:Slashdot Editors, Do Some Editing (Score:5, Insightful)
We live in a world where we have to automatically upgrade adobe PDF, java, windows, iTunes, firewalls, antiviruses, antispam, smartphones, wmv codecs, xvid codecs, divx codecs, everything HP ever produced, video game consoles, etc. Of course people automatically update their routers: it's what we've been conditioned to do.
Re:More reasons never to go consumer again (Score:2, Insightful)
*points to my $60 WRT54G*
It has been running OpenWRT in my apartment for the past three or four years. I couldn't be happier.
What nice things do I get for 3X the cost of this setup?
Re:Why... (Score:4, Insightful)
You don't get it. If doing such a thing were legal, lots of people WOULD buy from these people. Yes, it sounds insane, but remember, spammers and telemarketers make lots of money, even though most of us think it's idiotic to buy from such sellers. Of course, in reality, there probably wouldn't be enough people buying from the sellers blocking their way on the road to pay for their operating costs (this is why spam and telemarketing work so well, because the cost per potential customer is so low), but I guarantee a non-zero number of people would buy.
Re:RISKS: Hardware-borne Trojan Horse programs (Score:3, Insightful)
Re:Likely actionable sabotage. (Score:4, Insightful)
Regardless of whether or not you can disable it, unless it was an *advertised* feature -- if it redirected you to a fake, substitute website that was other than the website you _thought_ you were going to, isn't that evidence of an unauthorized invasion and hack of the device to introduce a 3rd-party, fraudulent, redirection mechanism that can potentially be used not only by D-Link, but also by a cracker attempting a phishing exploit?
In the US, the unauthorized addition of redirection software to a hardware device (which itself would probably qualify as a small computer), with the right lawyer or prosecutor, could result in jail time for the perp, or, if it's a corporation, probably a bonus for the project manger. ;^/